From 5ed5cde1a9a0f7368e33d5ec38d9dbb9aa817af9 Mon Sep 17 00:00:00 2001 From: Trevor Spiteri Date: Tue, 15 Jan 2019 18:58:59 +0100 Subject: out-of-bounds access on Enter-up-down in new text field https://bugzilla.redhat.com/show_bug.cgi?id=1612618 Reproduce using: 1. Select text tool (F8) 2. Click on empty canvas 3. Hit Enter 4. Hit Up 5. Hit Down --- src/libnrtype/Layout-TNG-OutIter.cpp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/libnrtype') diff --git a/src/libnrtype/Layout-TNG-OutIter.cpp b/src/libnrtype/Layout-TNG-OutIter.cpp index 3dc5c3e4f..761d58245 100644 --- a/src/libnrtype/Layout-TNG-OutIter.cpp +++ b/src/libnrtype/Layout-TNG-OutIter.cpp @@ -789,7 +789,10 @@ bool Layout::iterator::nextLineCursor(int n) - _parent_layout->_chunks[_parent_layout->_spans[_parent_layout->_lineToSpan(line_index)].in_chunk].left_x; } _char_index = _parent_layout->_cursorXOnLineToIterator(line_index + n, _x_coordinate)._char_index; - _glyph_index = _parent_layout->_characters[_char_index].in_glyph; + if (_char_index == _parent_layout->_characters.size()) + _glyph_index = _parent_layout->_glyphs.size(); + else + _glyph_index = _parent_layout->_characters[_char_index].in_glyph; return true; } -- cgit v1.2.3